Recovery needs model tests

A stateful property compares generated commands with real behavior. Deterministic initial state makes failures reproducible and shrinkable. Check the model by injecting a defect29.

Both function calls must be deterministic.

Source: Q1733; B1133, B433, B1533.

Failure it prevents

A vacuous or happy-path suite misses corruption across retries, cancellation, and restart.

Our Effect 4.0.0 reading

Arbitrary.checkEffect and @effect29/vitest run properties. TestClock and Deferred control Effect time and coordination. Author the command model; test persistent backends separately.

Source: packages/effect/src/Arbitrary.ts, packages/effect/src/testing/TestClock.ts, packages/effect/src/Deferred.ts.

How to check

Plant a known transition bug. Require the property to fail and yield a replayable, valid counterexample. This check is our proposal. The books do not prescribe it.

Continue with Checkpoints follow the promised commit10, Circuit breakers have state10.

Connect this to property-based testing23 and model-based testing15.

Use the durability skill for the full review. Return to the durability index34.

Sources

  1. Hebert, Fred. Property-Based Testing with PropEr, Erlang, and Elixir. Pragmatic Bookshelf, 2019.. Pragmatic Bookshelf. Chapter 7 Shrinking; Laying Out Stateful Properties; Testing Parallel Executions; Initial State for the State Machine; Adjusting the Model. Use the actual breaker’s threshold semantics. Accessed 2026-10-23.
  2. Nygard, Michael T. Release It!: Design and Deploy Production-Ready Software. Pragmatic Bookshelf, 2007.. Pragmatic Bookshelf. §4.4 Unbounded Result Sets; Chapter 5 Stability Patterns: §5.1 Timeouts, §5.2 Circuit Breaker, §5.3 Bulkheads, §5.4 Steady State, §5.5 Fail Fast, §5.6 Handshaking, §5.7 Test Harness, §5.8 Decoupling Middleware. Accessed 2026-10-23.
  3. Winters, Titus; Manshreck, Tom; Wright, Hyrum, editors. Software Engineering at Google: Lessons Learned from Programming Over Time. O’Reilly, 2020.. O’Reilly. Chapter 15 Deprecation: Deprecation Tooling and Preventing Backsliding; CI Is Alerting (hermetic and flaky tests). Accessed 2026-10-23.
  4. Effect contributors. Effect 4.0.0. Arbitrary.ts. Effect-TS. Pinned source for our Effect mapping, not a claim from the book. Accessed 2026-10-23.
  5. Effect contributors. Effect 4.0.0. testing/TestClock.ts. Effect-TS. Pinned source for our Effect mapping, not a claim from the book. Accessed 2026-10-23.
  6. Effect contributors. Effect 4.0.0. Deferred.ts. Effect-TS. Pinned source for our Effect mapping, not a claim from the book. Accessed 2026-10-23.

Last changed 2026-10-23 in 58dc623. Source on GitHub. Change log.

Linked from

  1. Agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.

    Recovery needs model tests — Test sequences of failures and recoveries against explicit invariants.

  2. Change log. What changed in the files served here, newest first.

    Recovery needs model tests — new page: docs(lore): land the durability wiki pages and bibliography

  3. durability. Keep a rat-stack app standing when a provider, pool, or dependency slows down or a worker dies. Use at any I/O boundary, connection pool, provider call, shared waiter, fan-out, flag, gate, or work that can outlive a request, or when asked "what happens when this is slow", "add a timeout", "make this durable", or "what survives a crash".

    Recovery needs model tests: generate crash and retry sequences.¶

  4. Durability starts with a recovery record. A reading order for storage, replay, worker ownership, overload, and recovery tests.

    Recovery needs model tests: Test sequences of failures and recoveries against explicit invariants.¶

  5. Full agent guide. An Effect stack so pure (aspirational) Kit Langton will blush.
  6. Model-based testing. Describe what a system should do as a small model, generate action sequences, and check the real system against the model.

    See also: Tests through supplied services and recovery needs model tests.¶

  7. Pure cores reduce timeline coupling. Move deterministic rules out of time-dependent actions and shared mutable state.

    Continue with Replay needs stable inputs, Recovery needs model tests.¶

  8. Rat Stack lore | rat-stack. Short, source-grounded notes on the ideas and decisions behind rat-stack.

    Recovery needs model tests — Test sequences of failures and recoveries against explicit invariants.

  9. Shared schemas need a transition period. Keep old and new representations usable while consumers migrate.

    Continue with Old events must still decode, Recovery needs model tests.¶

  10. Source change history (log.md). The generated change log as Markdown.

    Recovery needs model tests — new page: docs(lore): land the durability wiki pages and bibliography